Authentication
Send an API key as a bearer token. The key must carry the sites.view permission; a key without it is refused with 403, not 404.
Where your organisation id goes
This endpoint takes org_id as a query parameter. Leave it out and the call covers your whole tenancy subtree; send it to narrow the call to one organisation.
Your organisation id is on the API keys screen in your dashboard, beside the key itself. It is the same id in every call you make.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X GET https://api.zinndigital.com/v1/offers \
-H "Authorization: Bearer zdk_live_…"Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
⚖️ Owner, 2026-08-28: *"on the app overview screen should we not upsell some things"*, and — on how they are chosen — *"we shuld have 3 there and they should roate ... we should be able to devide in admin which ones to incluide and which not with siple on off swithc"*. Every **active** offer whose audience reaches this customer and whose signal is true for them, ordered by the rank an operator set, with copy already translated into the reader's own language. ⛔ **Every earned offer is returned, not the first `slots` of them.** The rotation that shows a different few on each visit is the client's, and it can only rotate over what it is given — truncating here would leave the dashboard cycling the same three cards for ever while appearing to work. The list is bounded by the size of a catalogue staff maintain by hand: tens, never thousands. ⛔ A reseller's own client is served an **empty list**, whatever the catalogue says. Selling Zinn® products at Zinn® prices inside a reseller's white-labelled dashboard, to the reseller's customer, undercuts the reseller who is paying us (owner ruling, same day). An account that is not in good standing is likewise never sold to (§2.46). ⛔ An offer whose link names a site the reader does not have is **dropped**, not rendered with a broken destination. Requires `sites.view`.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
org_id (query) | Uuid | No | Which organization this is about. Required when the caller holds more than one; a caller in exactly one may omit it. An id outside the caller's scope, or an omission by a multi-… |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
data | Offer[] | Yes | — |
slots | integer | Yes | How many to show at once. ⚖️ The owner's number (3, 2026-08-28), served in the payload rather than hardcoded in the SPA so changing it is a deploy of one service instead of a co… |
Errors this endpoint can return
401 · 403 · 429